Crashes in zend_accel_inheritance_cache_find since upgrading to 8.1.3 due to corrupt on-disk file cache

[mbiebl]

Description

I dont't have a minimal reproducer for this but an application which is based on sabre/dav running on Windows Server 2016 using IIS

Since upgrading from 8.1.2 to 8.1.3 I get frequent 500 errors.
In the event log I find

Log Name:      Application
Source:        Application Error
Date:          23.02.2022 11:26:34
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PSDEVMB.test.example.com
Description:
Faulting application name: php-cgi.exe, version: 8.1.3.0, time stamp: 0x62160b66
Faulting module name: php_opcache.dll, version: 8.1.3.0, time stamp: 0x62160b62
Exception code: 0xc0000005
Fault offset: 0x00000000000043a3
Faulting process id: 0xfd0
Faulting application start time: 0x01d8289fd314a2a7
Faulting application path: C:\Program Files\PHP\v8.1\php-cgi.exe
Faulting module path: C:\Program Files\PHP\v8.1\ext\php_opcache.dll
Report Id: f5dc9377-9cfc-46be-ad05-5ad40b0fafe7
Faulting package full name: 
Faulting package-relative application ID: 
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2022-02-23T10:26:34.226734200Z" />
    <EventRecordID>44517</EventRecordID>
    <Channel>Application</Channel>
    <Computer>PSDEVMB.test.example.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>php-cgi.exe</Data>
    <Data>8.1.3.0</Data>
    <Data>62160b66</Data>
    <Data>php_opcache.dll</Data>
    <Data>8.1.3.0</Data>
    <Data>62160b62</Data>
    <Data>c0000005</Data>
    <Data>00000000000043a3</Data>
    <Data>fd0</Data>
    <Data>01d8289fd314a2a7</Data>
    <Data>C:\Program Files\PHP\v8.1\php-cgi.exe</Data>
    <Data>C:\Program Files\PHP\v8.1\ext\php_opcache.dll</Data>
    <Data>f5dc9377-9cfc-46be-ad05-5ad40b0fafe7</Data>
    <Data>
    </Data>
    <Data>
    </Data>
  </EventData>
</Event>

The relevant opcache configuration from php.ini:

[opcache]
zend_extension=php_opcache.dll
opcache.enable_cli=1
opcache.enable=1
opcache.enable_file_override=1
opcache.file_cache="C:\Windows\temp\"
opcache.file_cache_fallback=1

I ran a git bisect since 8.1.2 was working fine.
The first faulty commit is 78fd573

Attaching a debugger to a running php-cgi.exe process, I see

Exception thrown at 0x00007FF992294F38 in php-cgi.exe: Microsoft C++ exception: std::out_of_range at memory location 0x00000013415FB250.
Exception thrown at 0x00007FF992294F38 in php-cgi.exe: Microsoft C++ exception: std::out_of_range at memory location 0x00000013415FB250.
Exception thrown at 0x00007FF992294F38 in php-cgi.exe: Microsoft C++ exception: std::out_of_range at memory location 0x00000013415FB250.
Exception thrown at 0x00007FF992294F38 in php-cgi.exe: Microsoft C++ exception: std::out_of_range at memory location 0x00000013415FB250.
Exception thrown at 0x00007FF956D743A3 (php_opcache.dll) in php-cgi.exe: 0xC0000005: Access violation reading location 0x0000015600000012.

PHP Version

PHP 8.1.3

Operating System

Windows Server 2016 / IIS

[mbiebl]

Disabling the PHP opcache file_cache by commenting out the line

;opcache.file_cache="C:\Windows\temp\"

seems to avoid the issue.

[cmb69]

The first faulty commit is 78fd573

That's somewhat unlikely, since that commit only changed some version numbers (it can be tricky to use git bisect, if the file cache is enabled). Anyhow, please provide a stack backtrace.

[mbiebl]

That's somewhat unlikely, since that commit only changed some version numbers

Correct, but it's reproducible. I'm also puzzled by that. I was wondering if the build system uses different flags when built with a -dev version?

[cmb69]

I was wondering if the build system uses different flags when built with a -dev version?

Ah, a -dev version produces a different zend_system_id, so that uses different OPcache SHM and file cache.

Anyhow, please provide a stack backtrace. :)

[mbiebl]

[Inline Frame] php_opcache.dll!zend_accel_inheritance_cache_find(_zend_inheritance_cache_entry * entry, _zend_class_entry *) Line 2252
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\ext\opcache\ZendAccelerator.c(2252)
php_opcache.dll!zend_accel_inheritance_cache_get(_zend_class_entry * ce, _zend_class_entry * parent, _zend_class_entry * * traits_and_interfaces) Line 2293
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\ext\opcache\ZendAccelerator.c(2293)
php8.dll!zend_do_link_class(_zend_class_entry * ce, _zend_string * lc_parent_name, _zend_string * key) Line 2781
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_inheritance.c(2781)
php8.dll!zend_bind_class_in_slot(_zval_struct * class_table_slot, _zval_struct * lcname, _zend_string * lc_parent_name) Line 1132
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_compile.c(1132)
php8.dll!do_bind_class(_zval_struct * lcname, _zend_string * lc_parent_name) Line 1165
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_compile.c(1165)
php8.dll!ZEND_DECLARE_CLASS_SPEC_CONST_HANDLER(_zend_execute_data * execute_data) Line 5320
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_vm_execute.h(5320)
php8.dll!execute_ex(_zend_execute_data * ex) Line 55210
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_vm_execute.h(55210)
php8.dll!zend_call_function(_zend_fcall_info * fci, _zend_fcall_info_cache * fci_cache) Line 897
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(897)
php8.dll!zend_call_known_function(_zend_function * fn, _zend_object * object, _zend_class_entry * called_scope, _zval_struct * retval_ptr, unsigned int param_count, _zval_struct * params, _zend_array * named_params) Line 986
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(986)
php8.dll!spl_perform_autoload(_zend_string * class_name, _zend_string * lc_name) Line 434
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\ext\spl\php_spl.c(434)
php8.dll!zend_lookup_class_ex(_zend_string * name, _zend_string * key, unsigned int flags) Line 1129
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(1129)
php8.dll!zend_fetch_class_by_name(_zend_string * class_name, _zend_string * key, int fetch_type) Line 1590
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(1590)
php8.dll!zend_do_link_class(_zend_class_entry * ce, _zend_string * lc_parent_name, _zend_string * key) Line 2758
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_inheritance.c(2758)
php8.dll!zend_bind_class_in_slot(_zval_struct * class_table_slot, _zval_struct * lcname, _zend_string * lc_parent_name) Line 1132
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_compile.c(1132)
php8.dll!do_bind_class(_zval_struct * lcname, _zend_string * lc_parent_name) Line 1165
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_compile.c(1165)
php8.dll!ZEND_DECLARE_CLASS_SPEC_CONST_HANDLER(_zend_execute_data * execute_data) Line 5320
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_vm_execute.h(5320)
php8.dll!execute_ex(_zend_execute_data * ex) Line 55210
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_vm_execute.h(55210)
php8.dll!zend_call_function(_zend_fcall_info * fci, _zend_fcall_info_cache * fci_cache) Line 897
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(897)
php8.dll!zend_call_known_function(_zend_function * fn, _zend_object * object, _zend_class_entry * called_scope, _zval_struct * retval_ptr, unsigned int param_count, _zval_struct * params, _zend_array * named_params) Line 986
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(986)
php8.dll!spl_perform_autoload(_zend_string * class_name, _zend_string * lc_name) Line 434
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\ext\spl\php_spl.c(434)
php8.dll!zend_lookup_class_ex(_zend_string * name, _zend_string * key, unsigned int flags) Line 1129
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(1129)
php8.dll!zend_fetch_class_by_name(_zend_string * class_name, _zend_string * key, int fetch_type) Line 1590
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(1590)
php8.dll!zend_do_link_class(_zend_class_entry * ce, _zend_string * lc_parent_name, _zend_string * key) Line 2713
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_inheritance.c(2713)
php8.dll!zend_bind_class_in_slot(_zval_struct * class_table_slot, _zval_struct * lcname, _zend_string * lc_parent_name) Line 1132
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_compile.c(1132)
php8.dll!ZEND_DECLARE_CLASS_DELAYED_SPEC_CONST_CONST_HANDLER(_zend_execute_data * execute_data) Line 7381
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_vm_execute.h(7381)
php8.dll!execute_ex(_zend_execute_data * ex) Line 55210
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_vm_execute.h(55210)
php8.dll!zend_call_function(_zend_fcall_info * fci, _zend_fcall_info_cache * fci_cache) Line 897
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(897)
php8.dll!zend_call_known_function(_zend_function * fn, _zend_object * object, _zend_class_entry * called_scope, _zval_struct * retval_ptr, unsigned int param_count, _zval_struct * params, _zend_array * named_params) Line 986
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(986)
php8.dll!spl_perform_autoload(_zend_string * class_name, _zend_string * lc_name) Line 434
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\ext\spl\php_spl.c(434)
php8.dll!zend_lookup_class_ex(_zend_string * name, _zend_string * key, unsigned int flags) Line 1129
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(1129)
php8.dll!zend_fetch_class_by_name(_zend_string * class_name, _zend_string * key, int fetch_type) Line 1590
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_execute_API.c(1590)
php8.dll!ZEND_NEW_SPEC_CONST_UNUSED_HANDLER(_zend_execute_data * execute_data) Line 10147
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_vm_execute.h(10147)
php8.dll!execute_ex(_zend_execute_data * ex) Line 55210
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_vm_execute.h(55210)
php8.dll!zend_execute(_zend_op_array * op_array, _zval_struct * return_value) Line 59773
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend_vm_execute.h(59773)
php8.dll!zend_execute_scripts(int type, _zval_struct * retval, int file_count, ...) Line 1762
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\Zend\zend.c(1762)
php8.dll!php_execute_script(_zend_file_handle * primary_file) Line 2535
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\main\main.c(2535)
php-cgi.exe!main(int argc, char * * argv) Line 2554
	at D:\a\php-ftw\php-ftw\php\vs16\x64\php-8.1.3\sapi\cgi\cgi_main.c(2554)
[External Code]